Incorrect Platform Fee Calculation Leading to Excessive Charges

Summary

An error in the platform fee calculation causes users to deposit double the intended amount as collateral, leading to potential loss of funds or denial of service (DoS).

Vulnerability Details

When users call PreMarkets::createOffer to create stock, they are charged a platformFee using the platformFeeRate.

Key Code Sections:

1. The platform fee rate is set in SystemConfig::updateUserPlatformFeeRate:

1. The platformFeeRate is constrained to be <= Constants.PLATFORM_FEE_DECIMAL_SCALER, which has a value of 1_000_000.

2. The problematic formula for calculating the platform fee:

The Issue:

The formula used to calculate the platform fee is incorrect, causing users to deposit an amount equal to the entire deposit as a fee. This error arises because the platformFeeRate can be equal to PLATFORM_FEE_DECIMAL_SCALER, resulting in the platformFee equaling the depositAmount.

Proof of Concept

Consider the following scenario:

• Deposit Amount: 100,000,000 USDC

• Platform Fee Rate: 1,000,000

Using the current formula:

This results in the platform fee being equal to the entire deposit amount, doubling the intended collateral.

Impact

This bug leads to a significant loss of funds for users and could potentially result in a denial of service (DoS) as users may be unable to proceed with their transactions due to excessive fees.

Tools Used

Manual code review.

Recommendations

According to Tadle's documentation, the platform fee should be 0.5% for all transactions. The developers need to reconsider the value range for platformFeeRate to ensure it reflects the intended fee percentage. Additionally, the formula for calculating the platform fee should be corrected to accurately calculate the desired fee.